Encrypted web traffic now exceeds 90% • Hacker News Board

Re: Encrypted web traffic now exceeds 90%

#131

Post by unilynx » Fri, Nov 01, 2019, 9:07 PM UTC

cesarb wrote: post #105

aesh2Xa1 wrote: post #14

Earlier quoted context omitted.

No, haha. When was that a thing?

Back in the 1990s and early 2000s, it was very common to have "transparent proxies": your router or the ISP's router was configured to transparently redirect all connections to TCP port 80 to a Squid caching proxy or similar running on a nearby server. This meant that images, CSS, JS, or even whole pages (the web was much less dynamic back then) were transparently cached and shared between all users of that router. T…

A common problem back then with those caches back then was that in their common configuration they would limit the maximum upload size to a few megabytes... which would manifest itself as a broken connection when such an upload was attempted.

We regularly had to tell customers "can you try whether uploading works with this HTTPS link? now it suddenly works? okay, use that link from now on and complain to your network admin/isp"

Re: Encrypted web traffic now exceeds 90%

#132

Post by emptybits » Fri, Nov 01, 2019, 9:07 PM UTC

whydoyoucare wrote: post #88

svara wrote: post #77

Earlier quoted context omitted.

You're not wrong, but the realistic alternative is having it the same way, just without any encryption.

Which is fine too, since not all communication needs to be secure (even on the internet). These numbers are meaningless without a proper context and can potentially create a "security theater".

> not all communication needs to be secure

There are good reasons to make all communication, even trivial conversations, secure.

If we only secure "important" communications then we are unnecessarily broadcasting useful meta information to prospective attackers. Encrypted communications rise to the foreground in visibility and that gives away who and when and where sensitive information is shared.

OTOH, if we secure all communication then we make the work of attackers or over-reaching governments much more difficult because no communication clearly says "high value sensitive information"

Re: Encrypted web traffic now exceeds 90%

#133

Post by meche123 » Fri, Nov 01, 2019, 9:08 PM UTC

Oh, so finally most of the porn sites are defaulting to https?

Re: Encrypted web traffic now exceeds 90%

#134

Post by profmonocle » Fri, Nov 01, 2019, 9:11 PM UTC

codexon wrote: post #114

frankzen wrote: post #74

The Federal Government may not like this but this is heading to as it should be. Sometimes the government needs to be saved from itself!

Governments can force CAs to give them certs. HTTPS only stops non-government attackers.

They would be killing the CA by doing this, since all certs have to be publicly logged in order to be trusted by Chrome or Safari: https://en.wikipedia.org/wiki/Certificate_Transparency

If a minor CA suddenly issued a cert for, say, mail.google.com, they'd be distrusted by every browser/OS within days. If a government made a habit of doing this, there'd soon be no trusted CAs in their jurisdiction.

The US probably has the best chance of getting away with this since they also have all the major OS/browser vendors in their jurisdiction. But if Mozilla/Apple/Microsoft/Google all mysteriously decided not to distrust a CA that was issuing bogus certs for high-profile sites, it would be pretty conspicuous.

Re: Encrypted web traffic now exceeds 90%

#135

Post by account73466 » Fri, Nov 01, 2019, 9:13 PM UTC

svara wrote: post #73

We often hear the complaint here that nobody cares / cared about Snowden's revelations. But to me it seems he did provide a lot of the impetus for having HTTPS virtually everywhere and a lot of the instant messenging apps being end-to-end encrypted. Most of WhatsApp's users are as non-technical as it gets, and yet they use the kind of encryption that only computer enthusiasts were interested in just a couple years ag…

He was very useful to inform the wider audience about global surveillance, make it "we already know that - boring!" and accelerate the progress of laws to extend it. In the end, this was his mission.

edit: thank you for the downvote, well-informed stranger!

Re: Encrypted web traffic now exceeds 90%

#136

Post by JoshTriplett » Fri, Nov 01, 2019, 9:18 PM UTC

whydoyoucare wrote: post #125

SlowRobotAhead wrote: post #92

Earlier quoted context omitted.

>Which is fine too, since not all communication needs to be secure (even on the internet). There was just an article on the front page today about "I have nothing to hide" and why it's wrong.

An example may illustrate my point: download software zip/tar files from a non-secure link. Obtain the signature and checksum files over a secure link, and verify the integrity of the software offline. Not every communication is about hiding personal stuff.

And then find that your file doesn't match, because your ISP brokenly injected a human-targeted message at the start of your download, or some proxy corrupted it by stripping out the executable (yes, this happens)...

Absolutely nothing is lost by encrypting the downloaded data as well.

Re: Encrypted web traffic now exceeds 90%

#137

Post by uxp100 » Fri, Nov 01, 2019, 9:18 PM UTC

I know this is good and all, but it does bum me out that Netscape 4.8 works much worse than it did even a few years ago. I prefer it to iCab, which might fair slightly better. Any suggestions for Mac OS 7.6 web browsers that support the minimum encryption required these days?

Re: Encrypted web traffic now exceeds 90%

#138

Post by lukeschlather » Fri, Nov 01, 2019, 9:18 PM UTC

stjohnswarts wrote: post #76

gambler wrote: post #67

I don't know why so many people here are patting themselves on the back over this. This is not the kind of encryption people were talking about in the 90s and 00s. A lot of this encryption is not point-to-point. It merely secures user's interaction with some middleman (or their server). What would the numbers be if you subtracted all the traffic that can be snooped on by Google, Amazon and Cloudflare?

What are you talking about about? I think you better look up how https/tls works??? Sure you have to trust the certificate authority. Also can you imagine the scandal that would erupt if Google or AWS cloud was discovered to be eavesdropping on companies running things in their cloud? I don't think so.

Google and AWS aren't eavesdropping directly. However a lot of companies are running unencrypted connections between their load balancers and their backend services. And we know from the Snowden documents the US Government does passive data collection there.

Re: Encrypted web traffic now exceeds 90%

#139

Post by alexis_fr » Fri, Nov 01, 2019, 9:21 PM UTC

stjohnswarts wrote: post #81

frankzen wrote: post #74

The Federal Government may not like this but this is heading to as it should be. Sometimes the government needs to be saved from itself!

I would say there is a 50/50 chance that the government has access to any http certificates that it needs to crack any https session that they would like to crack. The Patriot Act created secret courts to enable this type of stuff. They're well known to rubber stamp any warrant that comes through.

And it is not unimaginable that the US government can crack the RSA. That would explain why they are not requiring people to use short keys, yet still collect the data worldwide.

Re: Encrypted web traffic now exceeds 90%

#140

Post by profmonocle » Fri, Nov 01, 2019, 9:22 PM UTC

whydoyoucare wrote: post #128

gnode wrote: post #113

Earlier quoted context omitted.

You portray encryption as a magical energy. To the best understanding of cryptanalysis research, current TLS is secure. Hypothetically it could be broken and publicly unknown, but this is not a matter of "power". > the other endpoint It's not sensible to say encrypted web traffic is snooped on by an actor with direct access to the plaintext.

The simple statement made in OP, does not capture the complexity of operational security, which is very difficult to get right. I was merely trying to illustrate that. For e.g., even though TLS is end-to-end secure (and I don't doubt that), a website that uses CloudFlare front [1] is susecptible to its secure traffic being intercepted by CloudFlare, because by-design TLS would be terminated at CloudFlare servers'. Ho…

> a website that uses CloudFlare front [1] is susceptible to its secure traffic being intercepted by CloudFlare, because by-design TLS would be terminated at CloudFlare servers

Keep in mind, this is also true of cloud providers. By running the hypervisor, AWS has full access to your instance's RAM and could snoop on traffic if they pleased.

A compromised service provider is a risk you're accepting unless you own and physically control the hardware terminating TLS. Whether this is an acceptable risk comes down to your threat model. (As do so many things in infosec.)